go 44 lines · 6 steps

Setting and reading secure session cookies in Go

Three helpers write, clear, and read a hardened session cookie using Go's net/http package.

Explained by highlit
Intermediate cookies session-management security http authentication
1package auth
2 
3import (
4 "net/http"
5 "time"
6)
7 
8const sessionCookieName = "session_id"
9 
10func SetSessionCookie(w http.ResponseWriter, token string, ttl time.Duration) {
11 cookie := &http.Cookie{
12 Name: sessionCookieName,
13 Value: token,
14 Path: "/",
15 Expires: time.Now().Add(ttl),
16 MaxAge: int(ttl.Seconds()),
17 HttpOnly: true,
18 Secure: true,
19 SameSite: http.SameSiteStrictMode,
20 }
21 http.SetCookie(w, cookie)
22}
23 
24func ClearSessionCookie(w http.ResponseWriter) {
25 cookie := &http.Cookie{
26 Name: sessionCookieName,
27 Value: "",
28 Path: "/",
29 Expires: time.Unix(0, 0),
30 MaxAge: -1,
31 HttpOnly: true,
32 Secure: true,
33 SameSite: http.SameSiteStrictMode,
34 }
35 http.SetCookie(w, cookie)
36}
37 
38func SessionToken(r *http.Request) (string, error) {
39 cookie, err := r.Cookie(sessionCookieName)
40 if err != nil {
41 return "", err
42 }
43 return cookie.Value, nil
44}
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1Centralizing the cookie name in one constant keeps writing, clearing, and reading perfectly in sync.
  2. 2HttpOnly, Secure, and SameSite=Strict are the baseline flags that harden a session cookie against theft and CSRF.
  3. 3Clearing a cookie means re-sending it with an expired date and a negative MaxAge, not just dropping it.

Related explainers

go 
package streaming
 
import (
	"bufio"

Streaming NDJSON logs over HTTP in Go

http-streaming channels select
Advanced 10 steps
python 
import time
import uuid
 
from django.utils.deprecation import MiddlewareMixin

Attaching per-request context in Django

middleware request lifecycle multi-tenancy
Intermediate 7 steps
go 
package api
 
import (
	"crypto/sha256"

ETag conditional requests in Gin

http-caching etag conditional-requests
Intermediate 6 steps
go 
func (w *Watcher) resetDebounce(d time.Duration) {
	if !w.timer.Stop() {
		select {
		case <-w.timer.C:

Debouncing a stream of events in Go

debounce timers channels
Advanced 7 steps
java 
public static Map<String, String> parseCookieHeader(String header) {
    Map<String, String> cookies = new LinkedHashMap<>();
    if (header == null || header.isBlank()) {
        return cookies;

Parsing an HTTP Cookie header in Java

string-parsing http url-decoding
Intermediate 6 steps
go 
package logging
 
import (
	"context"

Deduplicating log attributes in Go's slog

decorator-pattern structured-logging immutability
Intermediate 8 steps

Share this explainer

Here's the card — post it anywhere.

Setting and reading secure session cookies in Go — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code